diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5d3f57339..17b54b7f09 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,7 +89,7 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
-      - run: npx vitest run --reporter=verbose --reporter=junit --outputFile.junit=test-results.xml
+      - run: npm test -- --reporter=verbose --reporter=junit --outputFile.junit=test-results.xml
       - uses: actions/upload-artifact@v4
         if: always()
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a9f16727be..d7449e8782 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,12 +28,12 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 22
-          cache: npm
+          node-version: 24
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org
 
       - run: npm ci
@@ -42,6 +42,4 @@ jobs:
         run: npm run build
 
       - name: Publish
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000000..466df71c83
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}
diff --git a/SECURITY.md b/SECURITY.md
index 8db9c93344..aba1525d98 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -8,7 +8,7 @@ Security fixes are provided for the latest published version of REA. Upgrade to
 
 Do not disclose vulnerabilities, proof-of-concept exploits, credentials, private binaries, or Hopper documents in a public issue.
 
-If private vulnerability reporting is available in the repository's **Security** tab, use **Report a vulnerability**. Otherwise, open a minimal issue asking the maintainer to establish a private contact channel; include no sensitive technical details in that issue.
+Use **Report a vulnerability** in the repository's **Security** tab to submit the report privately. Do not open a public issue to request a private contact channel.
 
 Include the affected REA version, macOS and Hopper versions, impact, reproduction conditions, and any suggested mitigation in the private report. Remove credentials, proprietary binaries, Hopper documents, socket capability tokens, and unrelated local paths from logs or examples.
 
diff --git a/tests/integration/configIntegration.test.ts b/tests/integration/configIntegration.test.ts
index 893f6e3f5b..57336ca63c 100644
--- a/tests/integration/configIntegration.test.ts
+++ b/tests/integration/configIntegration.test.ts
@@ -25,7 +25,11 @@ describe("configuration parsing integration", () => {
     if (!result.ok) throw new Error("unreachable");
     expect(result.value.hopperTargetPath).toBe("/usr/bin/true");
     expect(result.value.hopperTargetKind).toBe("executable");
-    expect(result.value.hopperLoaderArgs).toEqual(["-l", "Mach-O", "--aarch64"]);
+    expect(result.value.hopperLoaderArgs).toEqual([
+      "-l",
+      "Mach-O",
+      "--aarch64",
+    ]);
   });
 
   it("rejects target kind values outside the enum", () => {
diff --git a/tests/integration/serverIntegration.test.ts b/tests/integration/serverIntegration.test.ts
index 4fa247382a..9d3bd7c666 100644
--- a/tests/integration/serverIntegration.test.ts
+++ b/tests/integration/serverIntegration.test.ts
@@ -82,10 +82,13 @@ describe("full MCP integration with multi-tool sequences", () => {
   });
 
   it("preserves the complete 42-tool inventory with a session", async () => {
-    const session = new BinarySession((_path) => ({
-      callTool: () => Promise.resolve(ok(null)),
-      close: () => Promise.resolve(),
-    } satisfies BinaryClient));
+    const session = new BinarySession(
+      (_path) =>
+        ({
+          callTool: () => Promise.resolve(ok(null)),
+          close: () => Promise.resolve(),
+        }) satisfies BinaryClient,
+    );
     const server = createServer(
       { callTool: () => Promise.resolve(ok(null)) },
       session,